CyberRota Analysis
AI-GeneratedFFmpeg versions 0.6.3 through 8.1.2 are vulnerable to an infinite loop in the RTP/ASF demuxer, which can be exploited by remote attackers to create a denial of service condition through specially crafted RTP/ASF streams. This vulnerability can lead to CPU exhaustion, impacting the availability of services relying on FFmpeg for media processing. Organizations using affected FFmpeg versions should prioritize patching to mitigate potential service disruptions.
Original NVD Description
FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.
Related CVEs
Other vulnerabilities affecting the same vendor(s)